Configure Microsoft Entra ID

Sign in to the Microsoft Entra admin center on the Microsoft website.

Navigate to Enterprise applications > New application.

Choose Create your own application.

Enter a name for the application (for example, Spatial Data Management).

Select Register an application to integrate with Entra ID (App you’re developing), and then choose Create.

In the application registration, add the following Redirect URI with a platform type of Web:

https://<COGNITO_DOMAIN>.auth.<REGION>.amazoncognito.com/oauth2/idpresponse

Choose Register.

On the Overview page, note the Application (client) ID and the Directory (tenant) ID. You need these values later.

In your registered application, choose Certificates & secrets.

Choose the Client secrets tab, and then choose + New client secret.

Enter a description (for example, Cognito OIDC integration).

Set an expiration (a maximum of 24 months is recommended), and then choose Add.

In your registered application, choose API permissions > Add a permission.

Choose Microsoft Graph > Delegated permissions.

Add the following permissions:

In your registered application, choose Token configuration.

Choose Add groups claim.

Select Group ID for all token types (ID and Access).

Select Groups assigned to the application. This is recommended for large organizations to avoid exceeding the limit on the number of groups a token can emit.

Choose Save.

In your registered application, choose Manifest.

Locate the optionalClaims section, and add cloud_displayname to the groups claim for idToken and accessToken:

"optionalClaims": {
  "idToken": [
    {
      "name": "groups",
      "source": null,
      "essential": false,
      "additionalProperties": ["cloud_displayname"]
    }
  ],
  "accessToken": [
    {
      "name": "groups",
      "source": null,
      "essential": false,
      "additionalProperties": ["cloud_displayname"]
    }
  ]
}

Save the modified manifest.

In the Amazon Cognito console, choose User pools, and then select your user pool.

Choose Sign-in experience > Federated identity provider sign-in.

Choose Add identity provider, and then choose OpenID Connect (OIDC).

Configure the following:

Under Map attributes between your OpenID Connect provider and your user pool, configure the following mappings:

Choose Add identity provider.

Sign in to the Microsoft Entra admin center on the Microsoft website.

Navigate to Enterprise applications > New application.

Choose Create your own application.

Enter a name for the application (for example, Spatial Data Management SAML).

Select Integrate any other application you don’t find in the gallery (Non-gallery), and then choose Create.

In the enterprise application, choose Single sign-on, and then choose SAML.

In the Basic SAML Configuration section, choose Edit, and enter the following (see Gather your Amazon Cognito values for these values):

Choose Save.

In the Attributes & Claims section, choose Edit.

Confirm that the following claims are configured. Entra ID emits these standard claims by default:

(Optional) To use Entra ID groups for permission assignment in SDMA, add a group claim:

In the SAML Certificates section, copy the App Federation Metadata Url, or choose Download next to Federation Metadata XML to download the metadata file.

In the enterprise application, choose Users and groups.

Choose Add user/group, select the users or groups who should access SDMA, and then choose Assign.

In the Amazon Cognito console, choose User pools, and then select your user pool.

Choose Sign-in experience > Federated identity provider sign-in.

Choose Add identity provider, and then choose SAML.

Configure the following:

Choose Add identity provider.

After the identity provider is created, locate the Attribute mapping section and choose Edit. Map the SAML attributes to user pool attributes:

Choose Save changes.